About popoymaster

Thanks @OtakarKlier, great video there.   Our client's External DNS (Cisco Umbrella) is expiring soon, so they want to utilize the Palo Alto DNS Security, problem is im having some trouble figuring how to route remote sites to use the Central Site's Palo Alto. ... View more

@ozheng ,    Our VPN concentrator is Fortigate, it has 2 vlans, Internal and Transport.   Internal where the DNS Server resides. Transport is connecting to the Inside interface of the Palo Alto.   Now, how is it possible to forward the traffic from Internal DNS Server and point to Palo Alto for DNS Security Filtering?     ... View more

@ozheng,   That is what exactly we want to implement, to push the traffic from remote sites going to the HUB, and let the Palo Alto do DNS Sinkholing (Licensed).   So my question is how? I am thinking to provision a DNS Server in the HUB, then that DNS Server push the DNS Query through PA for inspection.   Thanks, Wendell ... View more

Hello @ozheng , @TomYoung ,   Since Palo Alto cannot be used as DNS Server, can we just have our Internal DNS placed inside the HQ then forward the query to Palo Alto's DNS Security?     ... View more

Hi @TomYoung ,   This is the part we want really full understanding, so pointing users DNS Server to Palo Alto interface?   Will Palo Alto acts as a DNS Server?   Thanks,  Wendell ... View more

Hi @TomYoung ,   Thanks for your response.   You are talking about backhauling the internet traffic to from remote sites to the hub right?   I don't think that is the direction our client wants to do it.   Thanks,  Wendell ... View more

What do the traffic logs show on the on-prem and Azure NGFWs for the pings that fail?  - I can see the traffic going out of On-prem NGFW but not arriving at Azure NGFW. Ping test to interfaces logged and worked but not to the GP Subnet.     Azure NGFW only sees traffic going to the interfaces, but not destined to GP subnet.   ... View more

Do you have a rule on the Azure NGFW that allows traffic to GP for S2S VPN? - On-prem NGFW tunnels with Azure Native VPN Gateway. I enabled the intra and interzone loggs – this should capture anything not matched right? ... View more

Do you have a rule on the on-prem NGFW that allows traffic to the GP subnet?  - YES! Bi-directional. ... View more

Do you have a route on the on-prem NGFW to the GP subnet that points to the tunnel? - YES! Azure NGFW’s management and GP subnets are pointing to tunnel.   ... View more

Do you have a route on the on-prem NGFW to the GP subnet that points to the tunnel? - YES! Azure NGFW’s management and GP subnets are pointing to tunnel.     Do you have a rule on the on-prem NGFW that allows traffic to the GP subnet?  - YES! Bi-directional.   Do you have a rule on the Azure NGFW that allows traffic to GP for S2S VPN? - On-prem NGFW tunnels with Azure Native VPN Gateway. I enabled the intra and interzone loggs – this should capture anything not matched right?   What do the traffic logs show on the on-prem and Azure NGFWs for the pings that fail?  - I can see the traffic going out of On-prem NGFW but not arriving at Azure NGFW. Ping test to interfaces logged and worked but not to the GP Subnet.     Azure NGFW only sees traffic going to the interfaces, but not destined to GP subnet.   ... View more

Hi Tom,   Do you have a route on the on-prem NGFW to the GP subnet that points to the tunnel? - YES! Azure NGFW’s management and GP subnets are pointing to tunnel.     Do you have a rule on the on-prem NGFW that allows traffic to the GP subnet?  - YES! Bi-directional.   Do you have a rule on the Azure NGFW that allows traffic to GP for S2S VPN? - On-prem NGFW tunnels with Azure Native VPN Gateway. I enabled the intra and interzone loggs – this should capture anything not matched right?   What do the traffic logs show on the on-prem and Azure NGFWs for the pings that fail?  - I can see the traffic going out of On-prem NGFW but not arriving at Azure NGFW. Ping test to interfaces logged and worked but not to the GP Subnet.     Azure NGFW only sees traffic going to the interfaces, but not destined to GP subnet.   ... View more

Hi Tom,   Do you have a route on the on-prem NGFW to the GP subnet that points to the tunnel? - YES! Azure NGFW’s management and GP subnets are pointing to tunnel.     Do you have a rule on the on-prem NGFW that allows traffic to the GP subnet?  - YES! Bi-directional.   Do you have a rule on the Azure NGFW that allows traffic to GP for S2S VPN? - On-prem NGFW tunnels with Azure Native VPN Gateway. I enabled the intra and interzone loggs – this should capture anything not matched right?   What do the traffic logs show on the on-prem and Azure NGFWs for the pings that fail?  - I can see the traffic going out of On-prem NGFW but not arriving at Azure NGFW. Ping test to interfaces logged and worked but not to the GP Subnet.     Azure NGFW only sees traffic going to the interfaces, but not destined to GP subnet.   ... View more

PING from Azure NGFW works but not from the Onprem NGFW.   ... View more